Is CVE-2021-3560 (Red Hat Polkit Incorrect Authorization) being exploited in the wild?

Yes. CISA added CVE-2021-3560 to its Known Exploited Vulnerabilities catalogue on 12 May 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.

How to confirm active exploitation for CVE-2021-3560

The strongest signal here is not the CVE label itself, but whether it appears in CISA’s Known Exploited Vulnerabilities Catalog. For this class of issue, that means the vulnerability has crossed from theoretical exposure into a practical, adversary-relevant condition. Teams should treat that as a trigger to confirm whether the affected system is present, exposed, and monitored.

What matters next is whether the vulnerable component is actually reachable in your environment and whether the host has signs of privilege escalation or suspicious local activity. When a flaw affects authorization checks, exploitation often leaves weak traces unless endpoint logging, auditd, or EDR visibility is already in place.

Why Polkit authorization failures are operationally serious

Incorrect authorization in a local privilege boundary can turn a low-privilege foothold into root-level control. In practical terms, that means a successful exploit can change the trust model of the host, not just corrupt one application. The issue is especially dangerous on shared Linux systems, jump hosts, developer workstations, and servers where local access is easier to gain than administrative access.

A useful way to think about this bug class is that it undermines the enforcement point, not just a policy rule. If credential checks are bypassed for D-Bus requests, the attacker is no longer negotiating privilege, they are sidestepping it. That is why “only local access is required” does not make the risk small.

What to do if patching must wait

If you cannot remediate immediately, reduce the attack surface around the host rather than assuming the flaw is harmless because it is local. Limit who can obtain shell access, remove unnecessary sudo or console pathways, and isolate the system from untrusted users or multi-tenant exposure where possible. Use NIST Cybersecurity Framework 2.0 planning to keep mitigation, detection, and recovery decisions tied to a known asset inventory and ownership model.

For active exploitation windows, priority should go to compensating controls that narrow blast radius, increase detection, and preserve forensics. That includes preserving logs before making disruptive changes, because after privilege escalation the attacker may use the newly gained rights to tamper with evidence or disable local visibility.

Risk and Threat Considerations

Actively exploited local privilege-escalation flaws matter because they often become the second step in a broader intrusion chain. A foothold gained through phishing, exposed credentials, or another low-privilege access path can be converted into host takeover, credential harvesting, or lateral movement once the attacker reaches the vulnerable machine.

Failure mechanism: The authorization bypass allows an unprivileged process to obtain actions it should not be allowed to perform, so the attacker can cross from local user context into administrative control without satisfying the intended credential check.

Impact: Once privileged execution is available, the attacker can alter system state, disable defenses, access sensitive data, or stage follow-on compromise on adjacent systems that trust the host.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.AM-01 — Physical Devices and Systems Inventoried	Asset inventory is required to find exposed hosts running the vulnerable component.
	PR.AA-05 — Access Permissions and Authorizations Managed	The issue is an authorization bypass that defeats intended access enforcement.
	DE.CM-01 — Networks and Network Services Monitored	Exploitation is often detected through unusual host and service activity.
Recommendation — Inventory affected Linux hosts and prioritize remediation on exposed systems. Review local authorization paths and tighten access enforcement around privileged actions. Increase monitoring for anomalous local privilege-escalation activity and follow-on execution.
NIST SP 800-53 Rev 5	CM-8 — System Component Inventory	You must know where the affected component exists before you can remediate it.
	AC-6 — Least Privilege	Limiting local privilege reduces the blast radius of exploitation.
Recommendation — Maintain an accurate host and package inventory for vulnerable systems. Restrict local privileges to the minimum required for each user and system role.

Practitioner Guidance

What to verify: Confirm whether any Linux systems in scope run the affected Polkit component and whether local access paths are broader than they should be. If your environment already treats local user access as low risk, this is the point to challenge that assumption.

Decision rule: If a host is internet-facing, shared, or used as a stepping stone to other systems, treat this as a high-priority remediation item even if you have not observed abuse yet. Exploited-in-the-wild status means delay changes the risk profile, not just the schedule.

Practitioner takeaway: For KEV-listed privilege-escalation flaws, the right question is not whether the exploit is elegant, but whether an attacker can convert ordinary local access into trusted control before you rotate, patch, or contain the host.